The best spam protection for WordPress contact forms
You rarely need a new form plugin to stop spam. You need the right combination of features, most of which your plugin already has.
The short answer
For most WordPress sites the best spam protection is layered: your form plugin's honeypot and anti-spam token first, Cloudflare Turnstile if spam continues, and a content filter such as Akismet only for human spam. Keep entries of blocked messages, and add server-side protection if bots still get through.
The layers, compared
| Layer | What it stops | Visitor effort | Privacy |
|---|---|---|---|
| Plugin honeypot | Simple bots | None | Stays on your site |
| Plugin anti-spam token / time check | Fast bots, direct posting | None | Stays on your site |
| Cloudflare Turnstile | Most bots that load the page | Usually none | Shared with Cloudflare |
| reCAPTCHA v3 | Most bots that load the page | None | Shared with Google |
| Akismet | Known spam content, some human spam | None | Messages sent to Automattic |
The setup we recommend
- Honeypot and anti-spam token on every form.
- A week of watching entries or the spam log.
- Turnstile only if bots still get through.
- A link or keyword rule for human sales spam.
- Server-side protection in front of the form if spam survives all of this.
By form plugin
- Contact Form 7: no honeypot built in; add one with an add-on, plus an integration such as reCAPTCHA. Details.
- WPForms: built-in anti-spam protection and CAPTCHA options in its settings. Details.
- Elementor Pro forms: a honeypot field and reCAPTCHA field in the form widget. Details.
Check your version: plugins add and rename anti-spam features between versions. Look in the plugin's current settings for the options named here.
Common questions
Do I need to change my form plugin to stop spam?
Rarely. Switching on the protection your plugin already has, plus Turnstile if needed, is usually enough.
Is a premium anti-spam plugin worth it?
For busy business sites, often yes, especially if it keeps a log and adds content rules. Check what data it sends to third parties.
What if I use several form plugins?
Protect each one, or move to one plugin. Old forms on forgotten pages are a common source of spam.